fix(e2e): wait for panel /healthz before setup (v1.0.0 gate)

Supervisor RUNNING is not enough: the setup-token file is written before
ListenAndServe, and Docker host-port publish can lag. Poll /healthz first,
and stop ordered TestE2E steps after a failure so a nil panel cannot panic
and mask the real error.

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

test/e2e/panel_client.go

@@ -39,6 +39,27 @@ func newPanelClient() (*panelClient, error) {
 	}}, nil
 }
 
+// waitForPanelReady polls the host-published panel port until /healthz
+// returns 200. Supervisor reporting the panel process RUNNING is not enough:
+// the setup-token file is written in Start() before ListenAndServe, and
+// Docker's host-port publish can lag the in-container bind — either race
+// makes the first setup POST fail and leaves sc.panel nil for later steps.
+func waitForPanelReady() error {
+	client := &http.Client{Timeout: 2 * time.Second}
+	return waitFor("panel /healthz on "+panelBaseURL, 60*time.Second, 200*time.Millisecond, func() (bool, error) {
+		resp, err := client.Get(panelBaseURL + "/healthz")
+		if err != nil {
+			return false, err
+		}
+		defer resp.Body.Close()
+		_, _ = io.Copy(io.Discard, resp.Body)
+		if resp.StatusCode != http.StatusOK {
+			return false, fmt.Errorf("status %d", resp.StatusCode)
+		}
+		return true, nil
+	})
+}
+
 // readSetupToken reads the one-time setup URL SelfPost wrote to /data (bind
 // mounted at stageDir/data/setup-token) and returns just the token.
 func readSetupToken(stageDir string) (string, error) {